<p>Intelligence exists as a supporting function. It always has a purpose – to inform decision making and drive action. In the government this is inherently understood and the value of intelligence is easy to derive. However, businesses often struggle to determine the value of their threat intelligence team/organization/processes/tools. The terminology of Threat Intelligence (TI) is usually not compatible with the business lexicon, leading to misunderstanding of the purpose and value of TI. There are a few ways to address this, and we will look at one of them in the following post.</p><p>Within the government exists a policy that drives all intelligence operations; the National Intelligence Priority Framework (NIPF).</p><p style="text-align: center;">“The National Intelligence Priorities Framework (NIPF) is the primary mechanism to establish, disestablish, manage, and communicate national intelligence priorities. The NIPF reflects customers’ priorities for national intelligence support and ensures that enduring and emerging national intelligence issues are addressed.” (ICD 204, Part D Section 1)</p><p>This national-level document drives the development of objectives and helps define the scope of operations at intelligence agencies and within subordinate units. Without this framework, intelligence organizations are left with no guidance and most likely would answer the wrong questions and provide incomplete or inaccurate information. As you can imagine, a framework for your intelligence team is not only important—it is a requirement.</p><p>However, businesses do not have a NIPF or any sort of intelligence framework (usually). This leads to intelligence teams that lack focus and struggle with what information to provide to decision makers across all levels within the organization. While the business might not have a NIPF, they do have a generic, macro level set of priorities as can be seen below (not all inclusive):</p><ul><li>Grow revenue</li><li>Lower Expenses</li><li>Reduce/mitigate risk</li><li>Customer satisfaction and retention</li><li>Employee satisfaction and retention</li><li>Compliance Regulation</li></ul><p>This list can serve as a starter framework, as it outlines enduring issues businesses constantly seek to address. With these priorities in mind, the threat intelligence team can begin to derive objectives. There are some easily definable objectives that can directly support some of the above priorities.</p><p>Once the TI team understands the business objectives, they can align their operations and efforts to support the business. Not all of the business priorities will perfectly align with threat intelligence capabilities, and that’s okay. The first step is to get something in writing; even if it seems overly simplistic or too high-level. You can develop granularity and nuance as you build out your requirements. The following are a few thoughts for a new or young threat intelligence team on where to start and what questions to ask:</p><ul><li>Reduce expenses related to fraud and cyber crime<ul><li>Collaborate with the Fraud team to determine the top 3-5 types of fraud and ask what information would help them detect/prevent this in the future?</li></ul></li><li>Prevent data loss<ul><li>What does analysis of Incident tickets reveal about the nature and type of data targeted in previous data breach events?</li><li>​What vulnerabilities were exploited and by what means?</li></ul></li><li>Protect PII<ul><li>What systems store PII and how do the vulnerabilities of those systems line up with known exploitation vectors?</li></ul></li><li>Reduce business risk<ul><li>TIl can focus on reducing risk due to data loss and external threats by identifying actors and deriving intelligence on external threats targeting their industry, ensuring detection techniques and mechanisms are in place and able to catch these threats.</li></ul></li></ul><p>Sometimes you might get questions from executive leadership. Know how to respond - often they won’t ask the right question and you must be prepared to help them scope and rephrase in such a way that makes the ask achievable/answerable. Also, think about these ad hoc requests to see if there is a recurring theme; this may make for a good standing intelligence requirement.</p><p>As a former government intelligence analyst, my first job in the private sector was confusing and a bit daunting. However, I had good leadership that explicitly stated their requirements of the intelligence team and gave us a mission. Sadly, this won’t be the case in all organizations. New and seasoned threat intelligence analysts struggling to convey their value with executive leadership can take solace in the simple truth that they aren’t alone. The hard part is learning the business objectives and aligning your team’s activities with them. For the TI teams that can do this, their value and impact to the business will increase - as will the job satisfaction.</p><p><em>Reference “How to Define and Build an Effective Cyber Threat Intelligence Capability”, H. Dalziel</em></p>